GDPR & Data Protection
Last updated: June 1, 2026
This notice explains how Marsala Yazılım A.Ş., as data controller, processes the personal data of clca users in accordance with the EU General Data Protection Regulation (GDPR) and Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK).
1. Data Controller
Your personal data is processed by Marsala Yazılım A.Ş. as data controller, registered at Bilişim Vadisi İzmir, Gülbahçe Mah., İçmeler Cad. No: 14/1 B05, 35430 Urla / İzmir, Türkiye (tax no. 6121748678). Contact: [email protected], +90 532 155 69 36.
2. Categories of Personal Data
We process identity data (name), contact data (email, phone, address), customer-transaction data (subscription, request and support records), financial data (invoice and payment information — your card details are not stored by us and are processed by the payment provider Tosla), security data (IP address, logs, session information) and, where you consent, marketing data.
3. Purposes of Processing
Your data is processed to: manage membership and accounts; provide the service you request; run subscription and billing processes; deliver customer support and communications; ensure information security; comply with legal obligations; and, where you have given consent, carry out promotional and marketing activities.
4. Legal Bases for Processing
Processing relies on the following GDPR Art. 6 bases: performance of a contract (Art. 6(1)(b)), compliance with a legal obligation (Art. 6(1)(c)), our legitimate interests provided they do not override your rights (Art. 6(1)(f)), and your consent for activities such as marketing (Art. 6(1)(a)). The corresponding bases under KVKK Art. 5 also apply for users in Türkiye.
5. Recipients and International Transfers
Your data is shared, only to the extent necessary, with the payment provider (Tosla), hosting/infrastructure providers, and our accounting and legal partners; and disclosed to competent public authorities upon lawful request. Where infrastructure is located outside your jurisdiction, transfers are carried out with appropriate safeguards (e.g. Standard Contractual Clauses under GDPR Art. 46, or the conditions of KVKK Art. 9).
6. How We Collect Data
Your personal data is collected by automated or partly automated means in the electronic environment, through registration and contact forms, your use of the platform, your support requests and cookies.
7. Retention Period
Your data is retained for as long as necessary for the processing purpose and for the statutory retention periods required by applicable law (for example, 10 years for invoices and financial records under Turkish tax and commercial legislation). Once the period ends or the purpose ceases, your data is deleted, destroyed or anonymised.
8. Your Rights
Under the GDPR you have the right to access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and to object to processing, as well as the right not to be subject to solely automated decision-making. Users in Türkiye hold the equivalent rights set out in KVKK Art. 11. You may withdraw any consent at any time without affecting prior lawful processing.
9. Exercising Rights and Supervisory Authority
To exercise your rights, contact [email protected] or write to the Company's registered address; requests are answered within the statutory period (30 days). If you are not satisfied, you may lodge a complaint with the competent supervisory authority — in Türkiye, the Personal Data Protection Authority (KVKK Board); in the EU/EEA, your local Data Protection Authority.